Standards and legal framework in vehicle access protection

Technical standards and guidelines

DIN SPEC 91414-2

Technical rule of the German standards body DIN on planning, implementing and operating vehicle access protection concepts, without the force of law. For mobile and active barriers it recommends operational procedures, safety instructions and evidence of placement and effectiveness. Edition November 2022, current; DIN hands out the PDF free of charge.

ISO 22343-2:2023

International guidance on vehicle access protection, likewise not a legal norm. It describes how a protection concept is planned, implemented and operated; the scope in a specific case follows from the concept and the requirements. Part 1 covers the impact test itself (ISO 22343-1:2023).

ProPK “Protection against vehicle attacks”

Guidelines of the German police crime prevention program of the federal and state governments, recommendations without direct legal effect. They treat vehicle access protection as an ongoing risk management process with clear responsibilities, an operations log, documentation of special events and staff briefings. They become relevant in practice where authorities make them a requirement or where they count as the state of practice when assessing due care.

PAS 68 (withdrawn)

British specification for hostile vehicle mitigation: it defines how vehicle barriers are crash-tested and classified by vehicle mass, speed and penetration. BSI Group withdrew PAS 68 on 25 October 2023; new testing follows ISO 22343-1. The rating still matters: a great many installed barriers carry a PAS 68 class, and the market keeps using the name.

IWA 14 (withdrawn)

International Workshop Agreement of ISO for vehicle security barriers: part 1 set performance requirements and the impact test method, part 2 the application within a protection concept. Both parts are withdrawn and were folded into ISO 22343 in 2023. Here too, the class statements of installed barriers still read IWA 14.

Laws and ordinances

Duty of care (§ 823 BGB)

Whoever creates a source of danger or hosts a major event must take reasonable protective measures and keep an eye on their effectiveness. There is no obligation to document every opening; a traceable operating history does, however, make it easier in a dispute to show that measures were implemented and monitored.

Security services ordinance (BewachV) and § 34a GewO

Apply when a security company controls or operates the barriers, and they apply to that company. § 21 BewachV requires records of assignments and guards, § 17 BewachV a service instruction; § 16 BewachV and § 34a GewO govern the reliability and qualification of the staff.

GDPR for operator records

If it is recorded which person was at which barrier and when, that is personal data. A legal basis, data minimization, transparency and deletion periods are required; for employees, co-determination under § 87 BetrVG may apply. In the ControlHub, the depth of recording and the roles can be set accordingly.

KRITIS umbrella act

German implementation of the EU directive on the resilience of critical entities (CER). It obliges operators of critical facilities to carry out risk analyses and to take measures for physical security, which includes vehicle access protection.

NIS2

EU directive on network and information security, introduced in Germany by the NIS 2 implementation act. It extends cybersecurity obligations to more sectors and companies; for networked barriers that means encrypted communication, roles and permissions, and regular security updates.

What this means for operation

Operating documentation

The ControlHub logs movements, openings and messages per installation with a timestamp; the message archive answers why which installation was open when.

Effectiveness control

Health monitoring reports failures and faults, the map view shows the state of all installations in real time.

Responsibilities

Multi-tenant user management with a role and permission concept; permissions are personalized and time-controlled.

Evidence

The documentation and maintenance module keeps test reports, deadlines and the maintenance record per installation: ControlHub.

Whether this meets all requirements in a specific case depends on the protection concept, the official requirements and the contractual arrangement.

Barrier, control, evidence: who supplies what

Most of what these rules require has nothing to do with the barrier itself. A bollard stops a vehicle. It keeps no operating log, assigns no responsibilities, documents no special event and proves nothing about whether the measure worked. That comes out of operation, and operation runs through the control.

The barrier itself

Comes from a manufacturer, with a test certificate to ISO 22343-1. We do not make it. We will name partners and put you in touch if you do not have one yet; who they are is listed under partners and under sourcing certified barriers.

Control and evidence

Comes from us and is manufacturer-independent: SmartKit and BaseLink connect to any electronically controllable installation through volt-free inputs and outputs or Modbus TCP, and the ControlHub keeps the log, the roles, the deadlines and the maintenance file.

The protection concept

Stays with the operator, usually together with the authority, the planner or a security consultant. We do not write it, we supply the data that later shows what it prescribed was actually carried out.

You do not need to know which manufacturer fits before you talk to us. Describe the access point and the requirement; we will place what is being asked for and name partners for the barrier itself.